Executive brief
Simple Inventory System is a PHP-based inventory management application available for download from code-projects.org. The application contains a SQL injection vulnerability in its edit functionality that allows attackers to remotely extract sensitive data from the database, including user credentials, product information, and even arbitrary files from the server without requiring any authentication.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in the /InventoryManagement/edit.php file where the POST parameter 'id' is directly concatenated into SQL queries without sanitization or parameterized query preparation. An unauthenticated attacker can craft Boolean-based blind or time-based blind SQL injection payloads to enumerate the database schema, extract user credentials and sensitive data, and read arbitrary files via MySQL FILE privileges. The attack is remotely exploitable over the network with no authentication or user interaction required. Remediation requires implementing parameterized prepared statements, input validation, and restricting database user privileges.
Affected products
- code-projects Simple Inventory System 1.0
Timeline
- 2026-08-25: disclosed